Cogniveil in the European Union

Five instruments define what an EU regulated enterprise must be able to prove about the AI it deploys:

• DORA governs ICT risk and operational resilience for the financial sector. For banks and insurers it is usually the first question in any AI evaluation.
• The EU AI Act sets obligations on deployers of AI in regulated contexts: transparency, record keeping, human oversight, data governance. Use-case risk classification under the Act stays with you, the deployer.
• GDPR governs personal data wherever it appears in the work: onboarding files, access requests, HR records, client correspondence.
• NIS2 sets cybersecurity expectations for essential and important entities, including energy, telecommunications, and parts of public administration.
• CSRD obliges large companies to report on sustainability, and the evidence behind the report has to stand up to assurance.

Our posture on each is stated precisely, per regulation, on the compliance page. Our regulatory posture